how do token exchanges work with the limited smart contract methods?

Question

Looking at the source code for various token implementations (e.g. here and here) They have the following API:

// presume can only be "called" by owner.
Transfer(address to, number amount) 

// sender (exchange) must be authorised by owner
Transfer(address from, address to, number value)  {
     require(balanceOf[from] >= value);
    balanceOf[from] -= value;
    balanceOf[to] += value;
}

// presume can only be called by the owner. 
authorise(address broker, number value) 

If Bob owns 1000 tokens, and wants to sell them, presumably he sets a sale price (e.g. £1 per token) on an exchange (e.g. kraken, bittex)

If Jenny wants to purchase 50 tokens at £1, then the exchange can match this up.

Prior to the exchange, presumably the following takes place:

1. Bob registers his account (not wallet) with the exchange. He gives them his public key, e.g. 0x123
2. Jenny registers her account public key with the exchange, e.g. 0x456
3. Bob authorises the exchange (which also has an account) to transfer 1000 tokens*

Presumably the following flow takes place for the exchange?

1. Jenny deposits £50 into her account with the exchange (although many exchanges don't seem to support this) from her bank incurring bank charges.
2. exchange deducts £50 from Jenny's fiat balance held locally (not in blockchain)
3. Exchange issues transfer(bob, jenny, 50)
4. Exchange waits for X confirmations?
5. put the money into Bobs fiat account held at the exchange
6. Bob withdraws the money into his bank account or similar (incurring bank charges)

Questions:

1. Is the above flow correct?
2. If the exchange only receives X-1 confirmations, did the token transfer take place, and what does the exchange do with the money now? Give it to Bob, or back to Jenny?
3. In the transfer function, it checks from has enough tokens, then deducts the amount. What happens if this method is called twice at the same time? Potentially we have the situation that both check the balance is ok, then both deduct the amount, leading to a negative balance or similar. Are these methods synchronised (so only one user can be calling the function at a time)? I assume not because of the "The DAO" theft issue. In which case does Ethereum rely on assertions to catch Concurrency issues? If so does it "rollback" the credit to Jenny (I haven't seen any code for this). I assume this is made worse by the fact that the order of application of transactions is not guaranteed.
4. There is no record on the blockchain of the monetary value of the transaction right? It is only recorded in the exchange.
5. Does the exchange get its fees by taking some of the tokens (so jenny gets less than 50)?

Answer 1

Ahhh, so the disconnect here is traditional exchanges vs decentralized exchanges. In a traditional, centralized exchange, there's no need for an on-chain transaction everytime there's a trade. When you make an account at an exchange, and deposit a token, it all goes to the same wallet. The exchange tracks your balances in a centralzed database. This way, they can do trades completely off-chain and not worry about confirmations. Confirmations only matter to them when you're depositing

Decentralized exchanges (etherdelta) on the other hand do everything, or at least most things, on-chain. This means that a trade between two users actually creates a transaction. Confirmations don't matter for these systems because everything is already on chain, and a transaction between two users is atomic, meaning half of a trade can't possibly happen without the other half also happening.